All 15 Configuration & Options questions
More in Configuration & Options
What is the Options pattern, and why is it preferred over directly injecting IConfiguration into services? How does appsettings.{Environment}.json layering work, and how is the current environment determined? How do you validate configuration options at application startup to fail fast on misconfiguration? How do environment variables map to nested configuration keys in ASP.NET Core, given environment variables can't contain colons on some platforms? How does the command-line configuration provider let you override settings via arguments when running an application? How does the order of configuration provider registration affect which value wins when the same key is defined in multiple sources? What is the difference between IOptions<T>, IOptionsSnapshot<T>, and IOptionsMonitor<T>? How does the configuration binder handle nested objects, arrays, and complex types when binding a JSON section to a C# class? How does named options support configuring multiple distinct instances of the same options type? How does configuration hot-reload work with reloadOnChange for appsettings.json, and what are its limitations?
Advertisement
Back to results for “User Secrets)”
.NET › Configuration & Options

What is user secrets (dotnet user-secrets), and why should it only be used for local development, never production?

Intermediate

Answer

User secrets stores sensitive configuration values (API keys, connection strings) outside the project directory (in a per-user, per-project JSON file in the user's profile folder), keeping them out of source control accidentally while still being automatically loaded into IConfiguration during local development -- it's explicitly unencrypted and stored in plain text on the local disk, making it entirely unsuitable for production use, where a proper secret manager (Azure Key Vault, AWS Secrets Manager) should be used instead.
dotnet user-secrets init
dotnet user-secrets set "ConnectionStrings:Db" "Server=local;Database=Dev;"

// Automatically loaded in Development environment via:
// builder.Configuration.AddUserSecrets<Program>();  (added by default host builder in dev)
Real-world example A developer avoids accidentally committing their local database password to a shared Git repository by storing it in user secrets instead of directly in appsettings.Development.json, which would otherwise get committed alongside the rest of the code.

Common follow-ups: Where are user secrets actually stored on disk?;Why is user secrets specifically excluded from being enabled in Production by default?

Secrets Management & Configuration Providers (Key Vault User Secrets);.NET CLI SDK & Project Structure (csproj)
All 15 Configuration & Options questions